Skip to content
Breach Index · running record

Nuveen / TIAA data breach history: the 2023 MOVEit vendor hack, Infosys McCamish and account takeovers

TIAA runs retirement plans for teachers, university staff and non-profit workers; Nuveen is its asset management arm. Its biggest incident by far was in 2023, when a vendor that checks death records was hacked through MOVEit. This page records each incident we could verify from November 2016 to November 2026.

Short answer

Was TIAA hacked?

Not its own systems, as far as the public record shows, but its members’ data has been exposed through vendors. In 2023 Pension Benefit Information (PBI), a vendor TIAA used, was hacked through the MOVEit file-transfer flaw. TIAA said data on 2.6 million members was exposed, including Social Security numbers, birth dates and addresses, and that no information was taken from TIAA’s own systems (BankInfoSecurity).

In 2024 TIAA notified 8,977 retail customers that their data was caught in the October 2023 hack of Infosys McCamish Systems, another vendor; TIAA said its own systems were not involved (PLANADVISER). TIAA also files small notices when criminals log in to members’ accounts with passwords obtained elsewhere, such as a January 2025 case it reported to Maryland.

We found no breach notice naming Nuveen and no regulator cyber fine against TIAA or Nuveen.

Timeline at a glance

  1. 29-30 May 2023Clop exploits vendor PBI’s MOVEit server; TIAA member data downloaded. (BankInfoSecurity)Confirmed
  2. Jul 2023TIAA says 2.6M members exposed: SSNs, birth dates, addresses. (BankInfoSecurity)Confirmed
  3. Aug 2023Class action filed in New York federal court over the MOVEit exposure. (Cybersecurity Dive)Reported
  4. 29 Oct 2023Infosys McCamish Systems hacked; 8,977 TIAA retail customers notified in Sep 2024. (PLANADVISER / Maine AG)Confirmed
  5. 4-6 Jan 2025Account takeover with credentials from outside TIAA; reported to Maryland AG. (Maryland AG)Confirmed

Last updated November 13, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.

Nuveen / TIAA incident timeline, in detail

Confirmed = acknowledged by Nuveen / TIAA, a regulator filing or a court. Reported = credible reporting Nuveen / TIAA has not fully confirmed. Unverified claim = an attacker or leak-site claim.

Jan 2025ConfirmedAccount takeover / credential reuse

Account takeover using credentials obtained outside TIAA

What happened. TIAA told the Maryland Attorney General that on 6 January 2025 it learned someone had used correct user IDs and passwords to access a Maryland resident’s TIAA account between 4 and 6 January 2025. TIAA said its investigation found the credentials came from a source other than its systems.

Impact. One Maryland resident, offered 24 months of credit monitoring; credentials were reset and extra authentication monitoring added. Search results show further small TIAA notices in Massachusetts in 2024 and 2025 (via search; not opened), consistent with recurring individual account takeovers.

Sources: TIAA notice to Maryland AG (ITU-376221), 2025

Oct 2023 – Sep 2024ConfirmedThird-party / policy administration vendor

Infosys McCamish Systems hack exposes 8,977 TIAA and TIAA Life retail customers

What happened. Infosys McCamish Systems, a vendor that administers insurance and annuity products, was hacked on 29 October 2023 and found it on 2 November 2023. TIAA filed with the Maine AG on 27 September 2024, PLANADVISER reported. A TIAA spokesperson said there was “no involvement whatsoever of TIAA’s systems or recordkeeping platform.”

Impact. 8,977 people, including 81 Maine residents, per the Maine filing. Names and other personal identifiers; the full data set was not detailed. Infosys McCamish arranged identity monitoring through Kroll.

Sources: PLANADVISER, 2 Oct 2024

Aug 2023ReportedLitigation

Retired teacher sues TIAA over the MOVEit exposure

What happened. A proposed class action, Jentz v. Teachers Insurance and Annuity Association of America, was filed in federal court in New York, alleging TIAA did not use reasonable security, did not encrypt stored data and kept data longer than needed. It sought over $5 million.

Impact. Allegations only. TIAA declined to comment. We found no settlement in the sources we read.

Sources: Cybersecurity Dive, 14 Aug 2023

May-Jul 2023ConfirmedThird-party / file-transfer software

MOVEit hack at vendor PBI exposes about 2.6 million TIAA members

What happened. Pension Benefit Information (PBI) helps financial firms find out when customers die so death benefits can be paid. The Clop gang exploited a zero-day in PBI’s MOVEit Transfer server on 29-30 May 2023; PBI said it learned of it on 2 June. TIAA does not use MOVEit itself and said no information was obtained from its systems.

Impact. TIAA said data on 2.6 million members was exposed, including Social Security numbers, dates of birth and addresses (BankInfoSecurity). A later class action described names, SSNs, birth dates, addresses and gender. Exact counts differ by source; see below.

Sources: BankInfoSecurity, 24 Jul 2023 · Cybersecurity Dive, 14 Aug 2023 · DataBreaches.net on the Maine filing (not opened; via search)

Where the reports disagree

  • How many TIAA members in the MOVEit/PBI breach? TIAA told BankInfoSecurity 2.6 million. A DataBreaches.net headline (via search) gives 2,630,717 notified per the Maine filing, while a search summary of the Maine database listing shows 2,373,076. The Cybersecurity Dive report on the class action says about 2.3 million and Bloomberg Law (via search) “nearly 2.4 million”. The difference may reflect amended filings; we could not open the Maine page to check.

The pattern across the record

Vendors that hold the whole member file

Death-record matching (PBI) and policy administration (Infosys McCamish) both need full identities including SSNs. Both were hacked within six months in 2023, and both exposed TIAA members without touching TIAA’s systems.

Password reuse drives the small notices

TIAA’s own filings describe criminals logging in with valid credentials obtained elsewhere. Retirement accounts are attractive targets once a password leaks from any other site.

What it means for Nuveen / TIAA members — and what to do

If you had a TIAA retirement account in 2023, your SSN and birth date may be in criminal hands from the PBI breach. The practical risks are identity fraud and attempts to take over your retirement account.

  1. 1.Freeze your credit

    With an SSN and birth date exposed, a free freeze at Equifax, Experian and TransUnion is the single most useful step.

    SSN exposure action plan
  2. 2.Use a unique password and strong sign-in on your TIAA account

    TIAA’s 2025 notice describes an account taken over with a password stolen elsewhere. A unique password plus the strongest second factor available stops that.

    Phishing-resistant MFA planner
  3. 3.Watch for changes to contact details and payouts

    Fraudsters change the email, phone or bank details before requesting a withdrawal. Turn on alerts and check your account regularly.

    Account takeover lab
  4. 4.Check which company actually sent your letter

    PBI and Infosys McCamish letters may arrive under TIAA’s name. Read what was exposed and what monitoring is offered.

    Breach notice decoder

CISO takeaways

Rehearse a vendor breach that reaches millions

Practise scoping, regulator notices and member letters when a vendor holding your SSNs is hit.

Vendor Breach Lab
Have a third-party breach checklist

Ask which file-transfer tools vendors run, how fast they patch and how they will tell you.

Third-party breach checklist
Map notification clocks across states

TIAA’s notices span Maine, Maryland and Massachusetts. Map the deadlines before you need them.

Notification clock calculator

Sources

Company statements and regulator filings first, then reputable reporting. Reviewed November 13, 2026.

  1. 1.Service providers’ probe counts more victims of MOVEit hacks — BankInfoSecurity, 24 Jul 2023
  2. 2.TIAA hit with class action lawsuit over MOVEit — Cybersecurity Dive, 14 Aug 2023
  3. 3.TIAA notifying 2,630,717 after PBI alerts them to MOVEit breach (not opened; via search) — DataBreaches.net, 2023
  4. 4.TIAA swept up in Infosys breach — PLANADVISER, 2 Oct 2024
  5. 5.TIAA security breach notice (ITU-376221) — Maryland Attorney General, 2025

Frequently asked questions

Was TIAA hacked?

TIAA’s own systems were not reported breached, but members’ data was exposed through vendors: about 2.6 million in the 2023 MOVEit hack at PBI, and 8,977 in the 2023 Infosys McCamish hack. TIAA also reports individual account takeovers using passwords stolen elsewhere.

What was the TIAA MOVEit data breach?

In May 2023 the Clop gang exploited a MOVEit zero-day at Pension Benefit Information, a vendor that checks death records for TIAA. TIAA said data on 2.6 million members was exposed, including Social Security numbers, birth dates and addresses.

Is there a TIAA data breach settlement?

We found no settlement naming TIAA in the sources we read. Class actions were filed in 2023, including Jentz v. TIAA in New York federal court, and MOVEit claims were consolidated nationally (via search).

Was there a TIAA data breach in 2024 or 2025?

In September 2024 TIAA notified 8,977 customers about the Infosys McCamish vendor hack. In January 2025 it reported an account takeover to Maryland in which a criminal used valid credentials obtained outside TIAA.

Was Nuveen hacked?

We found no breach notice, SEC disclosure or leak-site claim naming Nuveen from 2016 to 2026.

More in the Breach Index

Same sourced, verification-tagged timeline, company by company — compare how peers have fared.

Coinbase data breachFinancial services

Bribed support agents, 69,461 customers, an 8-K.

TransUnion data breachFinancial services

4.4M people via a third-party support app (2025).

Apollo Global Management data breachFinancial services

Social engineering and cloud platforms.

Invesco data breachFinancial services

No confirmed breach; 2024 vendor ransomware in Japan

Or see the full Breach Index and how to read it.

Independent analysis for security-leadership education; not affiliated with or endorsed by Nuveen / TIAA. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.